This replaces the settings merging for the static
`OAUTH2_PROVIDER["SCOPES"]` setting.

Attention: Breaking change, only release with next major version. Can
be backported to minor release if support for old mechanism is glued
into the new one, with a deprecation warning.

Rationale: We drop Python <3.9 support

What did I drink when I wrote the original code? The relative import
`from .. import __version__` in the utility code in core, of course,
always imported from `aleksis.core`, no matter the real `AppConfig`
that inherited the utility code. Thus, the versions always showed the
version of AlekSIS-Core everywhere (whose version information was
broken ever since we renamed AlekSIS to AlekSIS-Core).

This change decouples the `get_version` code from the package level
`__version__` information, which effectively becomes optional now.

Add method to inject permissions to ExtensibleModels dynamically